Institute For Ethical Hacking Course and Ethical Hacking Training in Pune – India

Extreme Hacking | Sadik Shaikh | Cyber Suraksha Abhiyan

- shutterstock windows punch - With more hints dropped online on how to exploit BlueKeep, you’ve patched that Windows RDP flaw, right? –

Credits: The Register

Vital clues on how to exploit the notorious RDP bug, aka CVE-2019-0708 aka BlueKeep, and hijack vulnerable boxes, emerged online this week.

The growing number of hints can be used by folks to develop working code that attacks Microsoft’s Remote Desktop Services , on Windows XP through to Server 2008, and gains kernel-level code execution without any authentication or user interaction. You just need to be able to reach a vulnerable RDP server across the network or .

Such an intrusion would give an attacker full control of a machine. So far, publicly available proof-of-concept exploit code mostly crashes vulnerable systems, rather than commandeer boxes. It’s feared that publicly shared, working, and reliable remote code-execution exploits, built from the aforementioned hints and tips, will be used to create a worm that can move from machine to machine, infecting them via BlueKeep as it goes, while stealing information or rolling out ransomware.

Microsoft issued  patches for BlueKeep in May, though not everyone has installed them.

New details

Earlier this week, a researcher using the handle 0xeb_bp created a GitHub repository including a written in-depth analysis of the flaw, and incomplete proof-of-concept Python code that targets Windows XP.

BlueKeep is a use-after-free() in Remote Desktop Services’s kernel driver termdd.sys. There are more technical details here, by the Zero Day Initiative, however the summary is: it is possible to open a connection to a vulnerable RDP server, open a channel called MS_T120x00 through this connection, send a payload of malicious code, and then terminate the connection. That will trigger the bug, and with the right voodoo, cause the smuggled code to execute.

In order to do this, you need to pull off something rather tricky: spraying the Windows kernel’s heap memory pool with just right to achieve code execution. While the concept of heap spraying is understood by exploit developers and engineers, it hasn’t been publicly explained within the context of CVE-2019-0708 – until now.

0xeb_bp’s write-up in their GitHub repo details these vital steps, and how to overwrite the pool successfully. Although industry folks are aware of heap spraying, particularly in the context of browser exploitation, using the technique against the Windows kernel’s nonpaged pool of memory is non-trivial. For CVE-2019-0708, though, a walk-through on how to do just that is now public, and a video of it all working can be found here.

You may be relieved to hear the PDF deliberately omits certain details, such as the essential shellcode needed to commandeer a box. Also, it focuses on Windows XP, and the technique may not work on later editions of the operating system. However, along with exploitation tips detailed in a Chinese-language slide deck that appeared online two days ago, the difficult parts of a viable working exploit are now public, paving the way for someone to finish off the work and share it.

“The information here is already available within the Chinese hacker community,” 0xeb_bp pointed out.

WannaCry breaker and noted security researcher Marcus Hutchins, who is awaiting sentencing in the US for his role in developing banking malware, said this extra info will make it easier for white and black hats to exploit BlueKeep. “They provided the code to actually do the actual pool spray,” the Brit said, adding we’re probably now a week away from someone completing a working public exploit.

This should give admins who have yet to install Microsoft’s patches that last bit of motivation they need to get the bug walled off once and for all.

- logo16 - With more hints dropped online on how to exploit BlueKeep, you’ve patched that Windows RDP flaw, right? –

www.extremehacking.org

Sadik Shaikh | Cyber Suraksha Abhiyan, Ethical Hacking Training Institute, CEHv10,CHFI,ECSAv10,CAST,ENSA, CCNA, CCNA SECURITY,MCITP,RHCE,CHECKPOINT, ASA FIREWALL,VMWARE,CLOUD,ANDROID,IPHONE,NETWORKING HARDWARE,TRAINING INSTITUTE IN PUNE, Certified Ethical Hacking,Center For Advanced Security Training in India, ceh v10 course in Pune-India, ceh certification in pune-India, ceh v10 training in Pune-India, Ethical Hacking Course in Pune-India





Source link

No tags for this post.

LEAVE A REPLY

Please enter your comment!
Please enter your name here